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OFPICE OF SECURITY ANNUAL REPORT 
SECTION 1. GENERAL 


During FY 1973 the Personnel Security Division had the 
responsibility within the Office of Security to process 
security clearances of individuals for overt and seni-covert 
utilizetion by the Agency and to assist these employees in a 
broad spectrum of security areas by providing guidance as 
required or requested. The Personnel Security Division 
receives its requests for security clearance action from other 
components; e.g., the Office of Personnel, the Office of 
Logistics, and the Deputy Directorate for Science and Technology. 


Toward the end of FY 1973, i.e., mid May to the 50th 
of June 1973, the Personnel Security Division was heavily 
committed to the accomplishment of a large volume of ternina- 
tion security processings brought about by the Agency's major 
reduction in ferce and a large number of voluntary retirements. 
Over 700 of these interviews were conducted over the period — 
11 June to 30 June 1973. A Task Force team of ten professional 
personnel were assigned to these debriefing duties from their 
regular assignment in the Personnel Security Division appraisal 
function. In addition, 211 FOD'd summer employees were 
afforded personal interviews regarding their security respon- 
sibilities, policy on drug abuse, and ether Code of Conduct 
matters. uring the latter portion of PY 1973, planning was 
directed to the orderly implementation of a major reorganization 
within the Office of Security. 


The Interrogation Research Division was assigned the 
mission of obtaining information through the security inter- 
view and polygraph exemination technique for use by those 
officials charged with making security and suitability decisions 
on candidates for employment in or use by the Agency. 


The overall mission of the Division during FY 1973 
remained as a service support activity responding to requests 
from other Agency components both dowestically and world- 
wide. It is a continuing effort on the part of the Nivision 
to strive for improvement in the interrogation techniques 
and polygraph chart interpretation and to maintain our foreign 
language capabilities. 
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The Security Records Division (SRD) is a service 
activity. It provides current and leng-range support to 
the Office of Security through the development, management, 
utilization, and protection of security recerds. it operates 
several Automatic Data Processing Systeas in coordination 
with other components in the Office of Security and the Agency. 
Complete and current records and indices of security infor- 
mation on personnel and organizations of interest te the Agency 
are maintained. Liaison is provided with other U.S. Covernment 
rieeretg for the release of personnel security information. 
All Top Secret and Restricted Data material within the Office 
of Security is controlled by SRD. It maintains a central 
data base covering leaks of intelligence information to public 
information media, It rates a secure teletype communi- 
cations system between the Office of Security Headquarters 
and the The SRD maintains @ master 
index for the Intelligence Community of persons in the U.S. 
Government and private industry roved fer access to sensitive 
and compartmented intelligence. is index is automated and 
updated daily for the use of the Intelligence Community. 


Although operating under a T/0 of staff 25X11 
positions, a chronic vacancy situation 4 positions 
persisted throughout the year. Recruitment to fill these 
vacancies must be a factor beyond the control of the Agency 
er the vacancy problem would not have persisted throughout 
FY 1973. Similarly, while a microfiche camera and equipment 
were received on 6 November 1972 with the first filming of 
security files by SRD personnel taking place on 14 November, 
the program has been hampered by a lack of personnel. One 
professional was assigned to the microfiche preject from 
within the Office of Security but eutside ef SRD on 31 July 1972 
on an ever-strength basis and two clerical employees were 
detailed from within SRD to assist him. While the SRD Personnel 
Allocation in FY 1974 is to be reduced to eighty-five positions, 
&@ pending reorganization of the Office of Security will result 
in an increase te ninety-four positiens. Six of the new 

positions will be assigned to the microfiche project which 
will be carried eut by a new Micrefiche and Retirement Branch 
composed of twelve positions. 


Two factors are impacting on the SRD objective to 
replace existing manual controls and reporting activities 


associated with case processing procedures in the Office of 
Security with a fully operational sutomated CAPER-05 Systen 
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within the Manpower Control System. The implementation of 
Stage I of CAPER-O0S had te be moved back from 1% June 1973 

to 7 September 1973 by the SIPS Task Force due to technical 
problems. A pending reorganization of the Office of Security. 
by which disparate functions are to be consolidated will 
necessitate modifications in the CAPER-OS programming. This 
will further delay the implementation of Stage I of CAPER-OS. 


The mission of the Overseas Security Support Division 
(OSSD) is to establish and implement a security program to 
ensure maximum security fer Agency facilities end assets at 
all overseas installations, Excepted from this mission is 
eae fusey pebiad fer audiocountermeasures which is in the 
exclusive purview of the Technical Division. 


The mission is accomplished primarily through the tech- 
nique of comprehensive security surveys. Each overseas 
installation is visited in accordance with a predetermined 
schedule concemitant with general requirements established by 
the DDC and with due consideration for USIB directives 
applicable to the intelligence community as a whole. 


During the report period, two significant events caused 
some adjustment in priorities and approach to fulfilling the 
mission. The first event involved the transfer of all security 
equipment specialists from the Division to the Physical 
Security Division. This resulted in the requirement for OSSD 
to continue with cognizance over all equipment service 
requests by levying requirements on the P ysical Security 
Division which controlled the manpower assets. The second 
event which impacted upon the Division was the advent of the 
increased threat ef terrorist groups and their activities 
particularly in the Middle East. 

The transfer of security equipment specialists as a 
group, coupled with the normal annusl manpower turnover, 
resulted in the departure of ten officer personnel from the 
Division and the arrival of four new officers. This change 
of personnel did not significantly affect the accomplishment 
of the Division's objectives, but its impact will be sore 
significant during the early stages of 1974, The new inex- 
perienced officers will require training during which tine 
they will be relatively unproductive. The time consumed by 
OSSD officers performing the training will further impact upon 
productivity goals. 
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The Office of Security has had a discrete progran activity 
in the computer security field since 1967. Since that tine 
with the growth of computer applications and usage in the 
Agency and in the Intelligence Community, this program has 
steadily grown. The requirements for security support and 
paps nm the information handling area are continuing to 

rease; this trend is net expected to change through FY 1976, 
and there are no current indications that requirements will 
taper off even at that time. During FY 1973 the informetion 
handling security program is considered te have “come of age” 
in that its activities and accomplishments changed from a 
phecbatspat effort to an accepted dimension of overall security 
operations. 


The growth in security requirements in the information 
handling area has been not only in quantitative terns with 
the increase of computer applications and computer capacity 
but has alse continued to become more complex. Durin Fy 1673 
the coupiexity of these requirenents was highlighted by . 
(a) initial planning for the OJCS Mass Storage System, (b) 8 
greater impetus to the networking of computer systems beth in 
the Agency and the Community, and (c) the development of 
substantial evidence of vulnerability in computer operating 
systems. The latter two are paradoxical insofar as sinul- 
taneously computer system requirements are becoming aulti- 
dimensional with the growth of networks and the threat of 
intrusion is becoming more evident. This paradox supports the 
need for increasing attention in the computer security area. 
In the current period of decrenentetion and limited resources, 
these ever growing requirements were the basis for examining 
eur computer security program during FY 1973 to organize it 
along gosi-oriented objectives. This reorganization of the 
abd, bag was inplemented early in FY 1974 and will form the 
asis for a valid evaluation of its progress in the coming year. 
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In FY 1973 the decision of the winter of 1971 to establish 
an in-house security alarm and electronic capability began 
to bear fruit. For a sum roughly equivalent te the anount 


' being paid a private contractor to maintain the Headquarters 


aleara systems, two electronic engineers and three electronic 


' technicians were hired on a contract basis. As a resuit, 


security alarm installation, maintenance, and repair at 
Headquarters has payroves by at least a facter of two with a 
very substantial fallowt to the other electronic programs of 
the branch. Additionally, elmost one full man year of support 
overseas to the Overseas Security Support and Technical 
Divisions was provided by the Physical Security Division. 


The Safety Staff, in accordance with established Agency 
regulations, is responsible for formulating and recommending 
to the Director of Security policies and practices for an 
effective safety program. The ete must be conducted in 
accordance with the Occupational Safety and Health Act ef 
1970 and Executive Order 11612, which defined the expected 
participation of each Federal agency. In an attempt te conduct 
an effective Agency Safety Program, certain of the activities 
were placed inte subprograms. This was done to effect better 

ezent and to analyze the shortcemings and successes of 
the overall pregram. One of the greatest prebleas is the 
demand placed by other components to service thom on a daily 
basis. Although such demands are met, the other subprograns 
are seriously affected. 


The Investigations and Operations! Suppert Directorate 
(10S) assists with the preparation and execution of the Agency 
security program insofar as it relates to the fields of 
Investigation and suppert ef Agency covert 
operations. It i sponsible for planning and 
i=plementing the investigations and operational rig d eth ro- 

e 


rams through the administration and direction of Office 
25X1 | | 


The objectives for IOS, that is, te maintain a viable 
investigative capability to support the Personnel Security 
Program (under EO 10450 and 3; to support the 25X1 
Clandestine Service (under and to fully sustain a 
program of operational suppert encompassing 211 Prt aes Agency 
eleaents, continued to be maintsined during FY 1973 with fewer 
available personnel without decreasing the quality of the product. 
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Problem areas centinue to confront the investigator in 
the field on a daily basis. These areas are the effect of 
“Invasion of Privacy"; the increased resistance to release 
information in the educational, credit, and legs] areas: and 
the increased difficulty $f mobility within the community. 
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SECTION II. ACCOMPLISHMENTS 


a. Objective 1 (0S) 

(1) The Personnel Security Division will process 
approximately 2200 applicant cases involving field investi-. 
gations and 7392 cases involving name checks only. 

(2) Action Plan 

Process approximately 550 field and 1850 name 


check cases by 30 September 1972, 31 December 1972, 30 March 
1973, and 30 June 1973. 


(3) Progress and Shortfall 
Full accomplishment was achieved despite the 
fact that there was a 14.4% increase over FY 1972 in the number 
of cases security disapproved. 
(4) Problems 
Processing of security disapproval cases involves 
comprehensive summary write-ups and evaluation memoranda. The 
greater the number of disapprovals, the more appraisal workload 
time is required, 
(5) Future Plans 
Under the reorganization, applicant type cases 
will continue to be processed. However, the investigative/ 
appraisal functions will be consolidated, thus eliminating 
duplication. 
(6) Costs 


51.1 man years or $1,018,700. 


b. Objective 2 (0S) 


(1) Service requests for 1900 polygraph examinations 
originating in Office of Personnel and other overt sources. 
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(2) Action Plan 


Conduct approximately 475 examinations by 
= a trad 1972, 31 December 1972, 30 March 1973, and 50 
une * 


(3) Progress and Shortfall 


Our goals in the Interrogation Division are 
prinarily to improve the quality of our polygraph interrogation 
performance to the complete gatisfaction of the consumer. We 
evaluate our results by the success of our finished product. 

An interrogation is a success when significant information is 
obtained that was previously unobtainable by other investigatory 
methods or when an evaluation is made that a polygraph subject 
has ne meaningful information to contribute and has been truth- 
ful during interrogation. 


During FY 1973 a total of 1944 polygraph 
exaninations were conducted on cases originating in the Gffice 
of Personnel and other overt sources. From this total, 745 
reports were produced containing significant information. 


(4) Problezs 


A reduction of the number of available exauiners 
towards the latter half of FY 1973 was experienced as a result 
of the unexpected retirement of senior personnel and the 
surplusing of three examiners. This reduction necessitated 
2 re ncement of priorities, particularly in our servicing 

During FY 1973 one new man was 
recruited gnc ned, a process which involved the full time 
of our Training and Research Officer for a period of two months. 
_ The new trainee is still in an apprentice status after six 
months. The Division cannot replace retired or surplused 
personnel by recruitment of new men without allowing for a 
loss of manpower for a period of three to six months while 
training and monitoring of the new man roceeds. Further 
reductions in manpower at this time would seriously impair our 
ability to service domestic requests on 4 timely basis. 


(5) Future Plans 
Continue to provide polygraph support in response 


to requests from the Office of Personnel and other overt sources 
on @ timely basis. 
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(6) Costs 
$ man years or $159,483. 


c. Objective 3 (05) 


(2) Action Plan 


Conduct approximately &5 examinations by 30 
Septenber 1972, 31 December 1972, 30 March 1973, and 30 June 
197 


(3) Progress and Shortfall 
During FY 1973 progress towards ovr goal in 


conducting an estimated 350 cases was considerably exceeded 
as reflected in the statistical summary below: 
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d. Objective 4 (08) 


(1) Conduct research towards improvement of the 
polygraph technique and instrumentation, 


(Z) Action Pian 
Assist ORD/DD/S&T in polygraph related research 
and bring to ORD attention areas of potential research. Evaluate 


developments and studies in lie detection by other government 
agencies, private and foreign organizations. 
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Probiens 

Contained in paragraph 3 sbove. 
Future Plans 

Contained in paragraph 3 above. 
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(6) Costs 


During PY 1973 our research related costs 
came to approximately $3,000. This included three trips to 
California for two sen plus mileage for Research Officer 
activities in the greater Washington, D.C., area. Total 
manpower involved would approximate one man year. 


e. Objective $ (0S) 
(1) By utilizing and abhi meet existing manpower 
and funding levels, complete by 31 March 1974, the process 
of replacing existing manual controls and reporting activities 
associated with case processing procedures in the Office of 
Security with a fully operational automated CAPER-~OS System. 
(2) Action Plan 


9 July 1973 - Conduct one week course for 
Cathode Ray Tube CEREY terminal eperators. | 


13 July 1973 - Distribute Procedure Handbooks 
for processing points. 


16 July 1973 - Install terminal equipment and 
furniture. | 


1&8 July 1973 - Brief and train professional and 
supporting clerical personnel, 


30 July 1973 - Train terminal equipment operators. 


6 August 1975 - Test CAPER-OS System (with test 
data). 


-«-»Y September 1973 - Implement Stage I - the 
parallel operation of manual and automated case processing systens 
for all overt and overt miscellaneous type security clearance 
actions. 
(3) Progress and Shortfail 
The Action Plan for Cbhjective 5 was amended 


after the Director of Security was advised by the Director, 
SIPS Task Force on 27 March 1973 that the implementation date 
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for Stage 1 of CAPER-0S had to be delayed from 18 June to 7 
September 1973 due to technical problems, The first chrono- 
logicsl benchmark was moved back from 16 April 1973 to 9 July. 
1973 as a result. 


(4) Problems 


A further delay in implementing the Action Plan 
will occur because of the reorganization of the Office of 
Security. Under this reorganization, disparate functions are 
to be consolidated in a way that will necessitate modifications 
in the CAPER-O&8 program. 


(5) Future Plans 


These ere dependent on a new look at the program 
after the reorganization. 


{6} Cests 
$6 


£. Objective 6 (05) 


(1) By utilizing and reorganizing existing manpower 
and funding levels, achieve a net zero growth by 30 June 1975 
baa the Office of Security holdings at the Agency's Records 
enter, 


(2) Action Pian 


Purchase a microfiche cawera and equipment 
during November 1972. Process approximately 4500 files by 
30 June 1973. | 


{3)- Frogress and Shortfall 


Progress was made during the period in terns 
of milestones passed and action completed. Substantial progress 
in the future is expected as additional personnel are trained 
and assigned to this program. By the end of 50 June 1975, it 
4s expected that we will be processing at the rate of 20,000 
cases per year. This will mean a net zero growth by the Office 
of Security at the Agency's Records Center. 
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(4) Problems 


During the initial period, the microfiche 
program was hampered not only by a lack of personnel but by 
the necessity of assigning untrained personnel to the progran, 
thus requiring an extensive period of on-the-job training. 


(5) Future Plans 


_ With the purchase of a second microfiche camera 
during FY 1975, the Office of Security will reduce its holdings 
at the Records Center at a rate of approximately 20,000 files 
per year. 


(6) Costs 


. Three man years, plus $24,690 for microfiche 
camera and equipment. 


g. Objective 7 (0S) 


(1) Te better utilize the 6050 square feet of space 
dedicated to open file shelving by replacing fifteen double- 
faced ranges occupying en area of 2215 square feet of this 
space with mobile shelving, realizing an increase in file 
storage capacity of 94% in this area. 


(2) Action Plan 


A request for funds to procure aobile shelving 
was made in the FY 1975-1977 Program Call submission, and the 
availability of such funding in the FY 1973 budget was certified 
on 3 October 1972. An approval to purchase the mobile shelving 
was granted on 27 October 1972 by the Chief, Suppert Services 
Staff, Support Directorate. A "Requisition for Material 

and/or Services" was issued on 20 November 1972 toa eight 
corporations manufacturing and installing automated shelving. 
Bids were submitted by six of these vendors. A bid was 

selected 9 March 1973 and the resulting contract called for 
delivery and installation of the mobile shelving to be 

completed by & August 1973. 


(3) Progress end Shortfall 


The bid of the ————S 
[| seas accepted S March 1975 because their 
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equipment would more than double the linear feet of available 
shelving, an increase of 102% from 4320 linear feet to 8736 

linear feet and 4% more than required in the Agency's criteria 
on which the bid was based. Moreover, the 25X1 
made an allowance of $3,202 for existing shelving for a ne 

cost of $52,720 for the mobile shelving. An amendment to the 
contract was made to include an additional $8,736 for lighting. 
Since funds in the amount of $72,000 had been earmarked in the 

FY 1975 Budget for the mobile shelving, an amount of $10,544 


was made available f ¥ purposes as 8 result of the contract 
with aie it is anticipated that the aobile 
shelving w e installed and in operation by 20 August 19753. 
(4) Problems 
None 
(5S) Future Plans 
Complete installation by 1 September 1973, 
(6) Costs 
$61,456 


kh. Objective § (0S) 

(1) Maintain a program of comprehensive security 
surveys of a11 overseas stations and bases with a visitation 
rate at each facility of not less than once every twenty-four 
wonths, 

(2) Action Plan 

Complete fourteen surveys by 30 September 1972, 
31 December 1972, 30 March 1973, and 30 June 1973; a total of 
fifty-six surveys during FY 1975. 
(3) Progress and Shortfall 
he goal of the objective was exceeded by three. 


BY 
A total of fifty-nine security surveys were completed during 
the year. 
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(4) Problens 
None 
(3) Future Plans 
To survey cach overseas installation approxi- 
mately every eighteen months with no appreciable increase in 
staffing, but rather by developing a new system of conducting 
surveys and preparing the reports. 


(6} Costs 


6.5 man years (survey and report writing), 
$32,000 (travel costs only). 


i. Objective 9 (0S) 


. (1) To maintain, repair, and instali securit aquip- 
ment and devices as required at overseas stations and bases. 


(2) Action Plan 


; Visit a total of | __———__—s| stations and bases 25X1 
during FY 1973; approximately [ _| per quarter. 25X14 


(3) Progress and Shortfall 


The goal. of this objective was met in thet 
Ler wyrere ae tatiacions were visited. 491 safes were inspected 
wenee of surreptitious entry and provided preventive 
maintenance; sixty-one vault doors were inspected; twenty-five 
hew alarms were installed; twenty-four existing alarm systens 
were serviced, | 25X14 
were installed; six safe Ccabine EKOUtS. 
serviced; and inspections of forty-seven miscellaneous devices - 
key locks, etc., were completed, 


(4) Problens 
None 
(5) Future Plans 


To initiate a program to serialize each individual 
piece of safekeeping storage equipment in use at overseas 
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installations to ensure more adequate control ef its use, 
maintenance, repair, and final disposition. 


(6) Costs 


4.70 man years; $235,000 (exclusive of travel 
funds expended by DDO Divisions for which emergency service 
was provided). 


. §. Objective 10 (0S) 


(1). Bevelop suitable courses and provide training 
in appropriate aspects of overseas security for new survey 
officers, support officers, and selected | personnel destined 
for overseas assignnents. 


(2) Action Plan 


Combine classroom training and security survey 
work with on-the-job training for new survey officers by 30 
June 1973. Expand participation in Agency training courses 
attended by support officers. 


(3) Progress and Shortfall 


A one-week Security Survey Course was conducted 
in the spring of 1973 for twelve security efficers being 
assigned overseas or assigned to OSSD. One new survey officer 
accompanied a senior survey officer on a trip where the new 
officer was trained on three successive station surveys. A 
senior survey officer was made available to lecture students 
- at the Field Administration Course conducted for support 
officers destined for overseas assignuents. 


(4) Preblens 


The on-the-job training technique is excellent 
and 2 most productive system, but is quite time consuming. 


(5) Future Plans 
and the Security Survey Course to two weeks 
and, time permitting, run the course twice annually. Provide 


the three new security officers to be assigned to OSSD on-the- 
job training under the direction of a senior survey officer. 
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(6) Costs 


10 man yoars; $1,913 (this figure is already 
included in the cost figure for surveys noted under Objective 


k. Objective 11 (0S) 

(1) Expand the use of presently available non- 
polluting devices for routine destruction of classified 
materials and encourage further efforts to develop additional 
such devices. . 


(2) Action Plan 


{5} Future Plans 
Ensure that every effort is made during surveys 
to educate personnel overseas to the edvantages of nospersuerns 
devices for the destruction of classified meterial both 
routinely and under emergency conditions. 
{6} Costs 


05 man years. 
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y. Objective 25 (DD/M§S) 

(1) To brief the Agency personnel assigned to over- 
seas on the Yostile Audio Surveillance Threat, as well as 
provide briefings to personnel in Mid-Career Courses and 
others as requested, 

(2) Action Plan 

To provide weekly briefings to Agency personnel. 


assigned to overseas stations and bases. Te provide other 
briefings as requested. 
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(3) Pregress and Shortfall 
Fully accomplished. During the FY 1973 period, 
briefings on the HAS threat wore furnished te 3650 personnel 
in 149 briefings given on a weekly basis and eleven briefings 
were afforded 345 personnel from other egencies. 
(4) Problems 
Minimal problems were encountered in the conduct 
of this program during the year. llowever, on certain occasions 
4t was necessary to give special briefings due to the time 
frame limitations of the availability of the persons to be 
briefed. 
(5) Future Plans 


In FY 1974 this effort will be continued to 
assure a proper understanding to the potential threat. 


{6} Costs 


The Briefing Program expended a total of two 
man years and $9,000 in the accomplishment of the objective. 


2. Objective 26 (DD/M§S) 
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aa, Objective 27 (DCI) 


(1) Enhance the effectiveness of the information 
handling security program by improving program manegement and 
specifically by conducting a review of Agency and Community 
requirements in the computer security area and designing a 
goal-oriented program to meet these requirements with mininal 
incresse in resource allocation. 


{2} Action Plan 


This objective encompasses the progran elements 
of program developrent, activity reporting, program review 
and evaluation, and personnel administration and training. 
During the second half of FY 1973, a study of computer security 
support requirements for the Agency and the Intelligence 
Cownunity was planned as a basis for oreeet tier the Infor- 
mation Handling Security Program along goal-oriented lines and 
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to adjust resource allocation and organizational positioning 
to better meet these requirenents. 


(3) Progress and Shortfall 


As planned, a thorough review of information 
handling security requirements was completed in the third 
quarter of FY 1973. During the fourth quarter a reorganization 
of manpower allocations to the program was developed which was 
implemented early in FY 1974 as part of the Office of Security 
reorgenization. The results of the reorganization included 
the assignment of two additional positions to the program, 
raising the activity from branch level to division level 
component of the Office. Further, as reflected in this report, 
program activities were organized under seven program categories, 
each with a defined objective, action plan, and milestones. 

It was recognized that the increase of only two positions in 
program resource allocation was somewhat less than what the 
priority of presram goals might support; however, the current 
era of Sesrepenenere™ and “tight” programming dictated such an 
approach. 


{4) Problens 
None 
(5) Future Plans 


The action plan for the program developed early 
4n the third quarter of FY 1973 has required subsequent 
modification due to the limitation on manpower and dollar 
resources for the program identified later in the programming 
cycle, A revised action plan detailing the projected activities 
within the program has recently been completed; this revised 
plan particularly limits earlier hopes of testing and evaluating 
the security of all major Agency computer systems by FY 1975. 

As an alternative, testing and evaluation offorts wT be 
highly selective and accent the highest priorities. 


{6) Costs 


During FY 1973, .75 mean year was expended on 
this program objective. 
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bb. Objective 28 (BCI) 


(1) Develop Agency security policy and standards 
referent to computer processing and storage of official data. 


(2) Action Pian 


Accomplishment of this objective is a continuing 
activity of developing in timely fashion policy and standards 
for the Agency to insure the protection of official data 
involved in computer operations. It encompasses not only the 
development of new policy but also periodic review of estab- 
lished policy and standards to assess their continuing 
effectiveness. uring FY 1973 promulgation of a Headquarters 
Notice concerning the classification of computer output 
material was planned. Further, Agency policy concerning the 
sanitization of computer storage media, security standards 
for remote terminal installations, and a revised Headquarters 
Regulation [_|concerning accountability for classified 
material were programmed for initial development. Finally, 
development of Data Distribution Security Standards fer 
buildings other than Hoadquarters was expected. 


(3) Progress and Shortfall 


As programmed, f'n | |was developed and 
promulgated establishing Agency policy for the classification 
of computer output material. Preliminary drafts of proposed 
security policy on the sanitization of computer storage media 
and the installation of remote terminals have been prepared. 
An initial draft of a revised HR has been written. 
Development of Vata Distribution Standards for other than 
Headquarters building has net been accomplished and is now 
programsed fer FY 1974, 


(4) Problems 


In the peste Mpeg ase has been encountered 
in coordinating security policy in the information handling 
field, in large measure due to the compromise approach to 
policy development in the Agency. Establishment of the 
Management and Services Directorate in the last half of FY 
1973 has suggested that policy development activities will 
take a more positive approach, and promulgation of regulatory 
issuances in the future are expected to be facilitated, 
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(5) Future Plans 


In addition to completing development of policy 
items already mentioned, during FY 1974 the initial preparation 
of a Headquarters Handbook on computer security is programmed. 
Further, during FY 1974 a review of Headquarters Data Distri- 
bution Security Standards is expected. 


(6) Costs 


During FY 1973 an estimated .5 man year was 
expended on computer security policy development, 


ec. Objective 29 (DCI) 


(1) Provide guidance and support to ms beet compo- 
nents and contractors to ensure protection of official data 
stored and processed by computers. 


(2) Action Plan 


The action plan related to the objective 
encompasses both continuing and discrete activities. On a 
continuing basis guidance and support is rendered to all 
Agency components involved in computer operations; this 
support includes not only Headquarters components but contractor 
sites whose security is under the cognizance of staffs in the 
Office of Logistics and the DD/S&T. Also on a continuing 
basis, the functions of Information Systems Security Officer 
with reference te BCID No. 1/16 and Distribution Systens 
Security Officer under the provisions of the Headquarters Dats 
Grid Standards are performed as part of the information 
handling security program. Further, computer security briefings 
and training sessions are provided to Agency personnel and 
components on a regular basis as part of OJCS training courses 
and on a periodic basis on special requests. 


Discrete projects which are encompassed under 
this objective included security support to the development 
of the OJCS Mass Sterage System, the OC Cable Dissemination 
System, the plans to network Headquarters computers, and the 
development and operation of security audit systems. 


Although most program elements falling under 
this objective call for continuous, periodic er aperiodic 
support, a Limited number of activities were specifically 
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planned for FY 1973. Among these discrete activities was 

a study to identify according to vulnerability priority 
deficiencies in Keadquarters data distribution lines installed 
prior to the Grid System, the development of a design for a 
security audit system for the OJCS Interactive Syster, 
participation in an Agency-wide effort to identify future 
computer terminal requirements and associated problems, and 
security support to the development of the Mass Storage System. 


(3) Progress and Shortfall 


Performance in the guidance and support area 
during FY 1973 met or exceeded expectations, Not only was 
security support rendered to Agency components and contractors, 
but the Information Handling Security Program was able to 
provide special support to OJCS in furnishing full-time back 
up for the second half of the Fiscal Year to the OJCS Security 
G€ficer, A security Audit System was designed for the OJCS 
Interactive System which is expected to be implemented early 
in FY 1974. As planned, the security deficiencies in Head- 
quarters data distribution lines were identified, ranked 
according to priority, and provided to the Office of Comuuni- 
cations who has already begun to correct deficiencies. [n 
the development of specifications for the Mass Storage Systen, 
security participation was present from the beginning and 
should serve to enhance the security of that system upon 
delivery in FY 1974 and FY 1975. This in itself was signifi- 
cant in that security became a design goal in the development 
ef the system from the very beginning. 


(4) Problens 
None 
(5) Future Plans 
Guidance and support te Agency components and 
contractors will be continuing; computer security briefings of 
Agency personnel and components will continue as required; 
during FY 1974 reactivation of @ computer security sexinar 
for selected Agency employees is expected. 
(6) Costs 


During PY 1973 it is estimated that 1.5 man 
years was expended toward this objective. 
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dd. Objective 30 (DCx) 


(1) Conduct inspection of Agency computer operations 
and analytical testing of Agency systems to evaluate the 
security of such systems and operations as a basis for their 
security certification. 


(2) Action Plan 


Accomplishment of this objective encompassed 
two distinct types of activities: inspection of Agency and 
contractor computer facilities and procedures; and the security 
analysis, testing and evaluation of computer systems and 
operations. The former of these two types of activities 
includes the security inspection of proposed terminal sites 
as well as the survey of computer installations and procedures. 
The latter testing and evaluation effort usually entails a 
comprehensive analysis of the security aspects of computer 
operations including the effectiveness of system hardware 
and software. 


During FY 1973 the number of remote terminal 
inspections could not be anticipated; however, it was expected 
that this number would surpass such requirements in any 
previous year. It was planned that accomplishment of the 
necessary remote terminal inspections would be done for this 
greater number of terminal installations and at the sane tine 
ensure that inspection actions would be compieted in other 
than unusual cases in less than twenty-one days from receipt 
of the inspection request. Programmed in the latter half of 
FY 1973 was a security survey of the ORD computer center. 


Also during the first half ef FY 1973, a 
comprehensive analysis, testing and evaluation ef the OJCS 
Interactive System was programmed for completion. A second 
security analysis, testing and evaluation of an OJCS system 
was scheduled to be initiated in the fourth quarter of FY 1973, 
viz., software analysis and evaluation of the GIM-II fata 
Management System associated with the Support Information 
Precessing System (SIPS). 


(3) Progress and Shortfall 


During FY 1973 a total of seventy-four remote 
terainal installations were surveyed and approved for operation; 
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the twenty-one day action schedule was normally net. The 
planned survey of the ORD computer center was accomplished on 
schedule. The analysis, test and evaluation of the oJCcs 
Interactive Systen was completed in Janusry 1973. The expected 
initiation of the GIM-Il software security analysis has been 
indefinitely delayed due to the lack of sufficient documen- 
tation and the continuing instability of the systen. 


The Interactive System test represented a 
significant accomplishment not only for the results received 
in identifying software vulnerabilities in the system, but 
also fer the experience gained in developing workable 
methodology for the security test and evaluation of large- 
scale systems. . 


(4) Problems 
None 
(5) Future Plans 


Initial security inspections of proposed remote 
terminal operations will continue. During FY 1974 a program 
of resurveying on an annual basis Headquarters arce rezote 
terminal sites will be initiated. Attempts are being made to 
develop procedures to conduct after-hours checks ef remote 
terminal sites to ensure that such terminals are properly 
disconnected from their parent computer system or disabled, 
such as to deny illicit atteapts at remote terminal access. 
1€ sufficient progress occurs in the stabilization of the 
GIM-II system and adequate documentation is produced, the 
software analysis and evaluation of the system will be re- 
considered late in FY 1974. During FY 1974 and early FY 1975 
a survey of NPIC computer operations and system security 
analysis and testing of NPIC computer nd Eada is planned. 
Yulnerability analysis and testing of the Mass Storage Systen 
is expected after its delivery during FY 1975. Conduct of a 
lah ho hg test of OJCS network operations is contesplated for 


(6) Costs” 
An estimated 1.75 man years of effort wes 


expended on this objective during FY 1978. In addition, 
contractor support for the software testing of the OJCS 
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‘Interactive System cost slightly over $60,000; these funds 
were allocated from the FY 1972 wedges and represented an 
approximate $9,000 underrun, $100,000 programmed in FY 1973 
for the GIM-II test was returned te the Sirectorate when the 
test delay was identified. - 


ee. Obfective 31 (BCT) 


(1) Identify and coordinate the development of 
solutions to administrative and technical problems associated 
with the security of Agency information handling operations. 


(2) Action Pian 


It is impertant to distinguish this ebjective 
from reutine guidance activities falling under Objective 29, 
abeve, The instant objective addressing probien resolution 
bespeaks activities asseciated with generic computer security 
problems, i.¢., issues of Agency-wide interest. Among 
Eeceree elements under this objective are the development and 

plementation of a concept and standards for the security 

labeling ef computer stored deta, the develepnent ef security 
measurement units to permit the epplication of quantitative 
methods te computer security assessment activities, the 
deve lony nf methodology and techniques to detect the 


review of the remote terminal monitor concept with a view 
toward its improvement or replacement by ether producers wes 
planned. All other program elenents under this hint barge 
were programmed for FY 1974 er for only initial thinking in 
FY 1973 with broeder development thereafter. 


(3) Progress and Shortfall 


Ne measure of progress in this area was antici- 
pated during FY 1973 except for the review of the ronote 
terninal monitor concept. This review was accomplished as 
part of the Interactive System test, but identification of 
improved options to replace this concept have not been identified. 


(4) Problems 
Difficulties associated with this ebjective are 
complex and in large measure are dependent on expensive research 
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and development. In addition, resolution of many of the 
problems associated with eemputer security is inhibited by 
the limited nusber of individuals knowledgeable in this area, 
it is expected that attempts will be made to identify within 
the inforsation handling security program a focal peint for 
the definition and coordination of Deen’ computer security 
R&D requirements. With the establishment of such a focal 
point, requirements in this area can be defined to meet Agency 
needs as a whole and levied upon the DD/S&T for fulfillment. 


(5) Future Plans 


Program elements in the problem resolution area 
remain as identified above. Specific progress is envisioned 
during FY 1974 in the development of a concept of labeling 
computer-stored date according to its security sensitivity, 
the development of a concept of security measurement =i 


te 


significant progress is not foreseen | 
(6) Casts 


Daring FY 1973 approximately .5 man year was 
expended toward this objective. 


££, Objective 32 (DCI) 


(1) Provide leadership and suppert te the Intelligence 
Community in addressing computer security issues of inter- 
Agency concern through the USIB structure as well as assistance 
to overall Government and non-Governnent efferts involved in 
the development of technology in the computer security field. 


(2) Action Plan 


Accomplishment of this objective includes both 
continuing efforts and discrete projects. The principal 
progras elenent under this objective is the direction and 
staff support of the USIB Computer Security Subcomittee. 
During FY 1973 within the Computer Security Subcommittee structure 
the development of a computer media sanitization policy and of 
an initial outline of a comprehensive Intelligence Community 
computer security policy document were scheduled. In addition, 
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at the request of another USIB committee, the Subcommittee 
was tasked to anslyze the security issue involved in upgreding 
the security level of the Community On-Line Intelligence 
System (COINS). . 


Also included in eur external suppert program 
category are continuing liaison support efforts to other 
Government agencies, notably the National Bureau ef Standards, 
the Office of the Secretary of Defense, the U.S, Communications 
Security Board, and non-Gevernment computer security efforts 
of mutual concern. A major program element is Agency support 
of the COINS Security Panel. In the liaison support area, 4 
significent project during the second half of FY 1973 was the 


focusing of Intelligence Community and other Government 
support of with reference to its performance of 

a contract fren Our fond of this contract 
was predicated on a declaration from the Office of Management 


and Budget to assist development of technology in the computer 
security field for the public domain. Our contribution was 
oriented toward the development of isproved techniques for 

the security evaluation of computer security operations, 
especially in the software field and the design of a secure 
operating system. Our action plan included suppert of this 

ed dh cia the last half of FY 1973 and the first half 

° * 


(3) Frogress and Shortfall 


Turing FY 1973 the Computer Security Subcommittee 
was active in guiding the Security Committee in the computer 
security area. It accomplished its review of the security 
issues involved in the COINS ps tenes completed drafting a 
Comaunity policy for the sanitization of cemputer storage media, 
and developed an cutline for a comprehensive Community computer 
security policy document. These accomplishments occurred 
generally on schedule. Liaison support was highlighted by 
informal coordination with BoD on the latter's development of 
a DoD computer security policy, performance as programmed in 
support off} and participation and assistance to 
the National Hureau of Standards in the latter's Government- 
wide intention of establishing a ceordinated effort outside the 
Intelligence Community directed at computer security problems 
ef national concern. The most significant shortfall in this 
- grea concerned the upgrading of the COINS Security Level, in 
that the decision to upgrade COINS was summarily made by the 
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Deputy te the Director for the Intelligence Community without 
the benefit of the Computer Seeurity Subcomzmitteo's assessrent 
of the security issue involved. 


(4) Problems 


The shortfall identified above referent to the 
COINS upgrading issue may be symptomatic of a breader void in 
our support of Community gh pd security problems. No action 
has been taken to overcome this preblem pending resolution of 
the revision of the USIB/IC Staf% structure and relationship 
issue. In the long run, however, an established procedure 
must be implemented to ensure timely computer security guidance 
in the Intellisence Community Staff decisions. 


(S$) Future Plans 


Support of the [sya bnort will contiaue 9 95x14 
through the second quarter ef FY 1974; ther continuation 
of this project and our support thereto will be evaluated at 
mid FY 1974. Development of the Intelligence Community computer 
security policy document will proceed through at least the 
first half ef FY 1974 and in view of the complex nature of this 
policy paper, its ceerdinetion within the Community may well 
extend through the fiseal year. Support of the COINS Security 
Panel will be continuing for the foreseeable future as well 
as liaison support to other Government organizations and 
agencies. Involvement in the coordination of the computer 
security annex of the National Communications Security Plan 
is anticipated in FY 1974. 


{6} Costs 
An estimated one man year of effort was expended 
toward this objective in FY 1973. 
gg. Objective 33 (DCI) 


(2) Establish an iaproved, less cumbersome systen 
of control aver Agency Tep Secret material. 


(2) Action Plan 
Pursuant to the decision of the Executive 


Director-Comptroller, the Agency Top Secret control function 
was programmed for transfer from the Centrel Reference Service 


ay 
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to the Office of Security in March 1975. In the earlier part 
of the third quarter of 1973, security persennel were 
projected for assignment to study and learn existing procedures 
of the Agency Top Secret contrel operation. Por the balance 
of FY 1973, subsequent to the Office of Security take over of 
this function, maiatenance of the existing system was planned 
while a review of the systen wag to be accomplished with a 
view toward improving eny deficiencies, making the system less 
cumbersome, and beginning the development of an upgraded Top 
Secret control program p which might include an automste 
contrel syste for Top Secret material. 


(3) Progress end Shortfali 


Two individuals from the Office of Securit 
began early in the third querter ef FY 1973 on-site in the 
Central Reference Service learning the mechanics of the 
existing Top Secret control program. On schedule in March 
1973, the Office of Security assumed the function, Shortly 
thereafter basic goals of an izproved, less cumbersone contro? 
systen wore outlined and during the final quarter of FY 19735 
this outline was developed in more detail. As indicated sbove 
under Objective 27, a revised Headquarters Regulation [| = 25X1 
has been drafted. A survey of compenent level control programs 
has been made with a view teward designing the requirenents 
for an Agency-wide autemated control system. Progress toward 
this objective has been completely according to plan. 


(4) Probleas 


While no problems have been encountered to date 
in this area, it is anticipated that some obstacles will 
appear during FY 1974, especially with regard to the elimination 
of established control procedures that are too cumbersome for 
some Agency components and considered vital in other areas. 
No specific measures to overcome these obstacles are being 
considered since in most cases they involve a reorientation of 
traditional thinking based on years of habit. 


(3) Future Plans 


Meintenance of the existing Tep Secret control 
program is foreseen through the third quarter of FY 1974, . 
during which time the upgreded, streanlined re ram will be 
developed, coordinated, and approved. Full implementation of 
this upgraded eierr after a period ef parallel operation is 
envisioned on 1 April 1974. 
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{6) Costs 


In FY 1973 an estimated .7% man year was 
expended toward this objective. 


hh. Objective 34 (0S) 


(1) Te ensure that CIA has a cadre of trained 
personnel to handle installation, repsir, and maintenance of 
physical security devices everseas by providing training to 
selected overseas designees. 


(2) Action Plan 


Provide two, two-week courses of in-depth 
training to members of the Office of Security being processed 
for PCS overseas assignment and to other Security Office 
personnel requiring highly specialised training in physical 
security devices. 


Provide a limited feiss security training 
program to representatives of other Agency components including 
the Office of Comaunications and military assignees as 
requested. This training is offered to provide the individuals 
with the capability of recognizing the differences between 
various security equipment and provides them with the capability 
to effect minor repairs, maintenance, and combination changes. 


Provide a familiarization program for Finance 
Officers, Admin Officers, and Logistics Officers who are being 
gent overseas and who will be required to change combinations 
ques assist in solving other Station physical security 
problers. : 


Provide specialized training and briefing programs 
to representatives of cther U.S. governmental agencies as 
requested. 

(3) Progress and Shortfall 

During FY 1978 twenty Security Officers were 

afforded two weeks of training in two separate sessions; in 


addition, all other training requests were met which included 
thirty representatives of other Agency components who were 
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provided with a throe-day train course; ninety-seven 
members of Office ef Logistics, Admin Officers, and Finance 
Officers were afforded a one-day training/briefing progran; 
and thirteen personnel representing other government sgeacies 
were afferded in-depth training. | 


(4) Problems 
Nene 
(8) Future Plans 
In regard to peapange future plans include but 
are not limited to an increasing effert to improve the 
standard and quality of training through the procurement of 
sophisticated training aids, a continuing supply of new 
training material, and the adoption and adherence to planned 
and programmed training schedules. 
(6) Costs 
Dellar costs for FY 1973 fer equipment procure- 


ment, training aid and fabrication and procurement rere 
$15,500, One man year. 


4i. Objective 3§ (05) . 
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Problens 

None 

Future Plans 

To continue to provide the same quality service. 
Costs 


Twelve man years. 


oo. Cbhjective 41 (DCI) 


'(1) Previde overt and covert clearance and investi- 
gative support on a greater productivity level without a 
atarberg in quality during FY 1973 than was provided in 


(2) Action Pian 


To complete a study by 30 September 1972 to 
determine ways to streamline investigative techniques and 
rocedures; complete $0$ of the FY 1975 caseload by 31 December 
972; and implement fully the recommendation of the study and 
complete another $0% of the FY 1972 caseload by 30 June 1975. 


(3) Progress and Shortfall 


A full accemplishment ef this objective was 
achieved. During FY 1973, 108 completed a total of 33,374 
cases of which 14,767 or 44% required field investigation. 
These figures compare with a total of 31,515 cases rar ee ae 
during FY 1972 of which 12,449 cases or 39% involved field 
investigations. 


Alse during FY 1973, ICS expended 94,339 man 
hours of operational support (equivalent to thirty-nine man 


years). This compares to 118,080 man hours of support for 
FY 1972 (equivalent to forty-nine man years). 
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The following illustrates the progress in teras 
of milestones: 


FY_1973 
30 September 1972: 
Completed study to streamline investigative techniques 
and procedures. 
31 Deconber 1972: 
Completed 14,687 cases, including 6551 casss 
involving field investigation. 
30 June 1975: 
Completed an additional 18,657 cases, including 8216 
cases involving field investigation. 


As a result of the study to streamline investi- 
gative techniques and procedures, the following was accomplished: 


25X1 
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5, The only activity carried out under our information 
handling security program but not subsumed under a listed 
objective relates to the coordination of office of Security 
plans and requirements for the application of ADP technology 
to Office operations. In short, this activity relates to the 
function of Information Processing Coordination within the 
Office of Security. It includes coordinating suppert on the 
part of the Office for the MAP project and providing Office 
of Security input on matters and issues coordinated through 
the Agency Information Processing Coordinator structure. 
Activities carried out in this area during FY 1975 were of a 
routine nature and no problems of great dimension were 
encountered. The most significant item among these activities 
was the discussions in the final quarter of FY 1975 with 
reference to the DDO proposal te integrate the Security index 
(SANCA) into the DDO Systen; this proposal was rejected 
after study by the Director of Security on the basis that 
current social pressures and the sensitivity of SANCA data 
supported its continued maintenance as sn independent system. 
An estimated .25 man year during FY 1973 was involved in this 
coordination functios. 


6. To vender safety support to all Headquarters and Field 
facilities on a daily basis and to participate in other 
activities required by law through reviewing plans and 
specifications for new construction and alterations; attendance 
at meetings of the Federal Safety and Fire Councils; reviewing 
shipping guides for hazardous materials; reviewing eaployee 
suggestions; conducting special tests for toxic vapors, noise 
levels, and illumination; briefing various components on the 
requirenents of the Cccupstional Safety and Health Act; 
distributing safety literature; and responding to any probleus 
relating to safety all without any increase in manpower. 
Dollar cost was $2,875 and man years expended were 3.77. 


7, Te maintain and repair safekeeping equipment located 
in the Headquarters area with no increase in manpower. 3.75 
man yeers and $12,062 were expended. 
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&. To provide security escorts to contractors and other 
workmen in Agency buildings in the Headquarters ares to 
ensure the security of our operations and prevent the loss or 
compromise of classified material. eereeyl reeran) 3/4 25X14 
staff man year, twelve full-time, an “nine part-time 
Contract Employees were utilized at 4 salary cost ef $159,107. — 


9. To manufacture, issue, end control #11 Agency badges 
and to issue and control-#11 other forms ef Agency credentials 
and identification, (3.5 man years and $12,055 were expended.) 


10. The Receptionist Section is pesbenesrce for the processing 
of visitors to Agency buildings. Individual receptionists 

are posted at selected building entrancos where they register, 
identify, and badge visitors as appropriate. Last year they 
handled 58,961 genersl visitors, 947 foreign nationals, and 

$299 applicants. They precessed 17,794 forgotten badges, 

7287 conference badges, and accepted 21,001 deliveries. In 
addition, the Section manned the collateral clerk's office 

whic ereceese’ 2229 traffic tickets. Sixteen man years were 
expended. 


11. The Federal Protective Officers who serve as the guards 
for Agency buildings and grounds are employees of the General 
Services Administration. They are supervised by their own 
officers and noncommissioned officers but are responsible to 
the Director of Security in security matters relating to the 
protection of Agency assets, Within the Office of Security, 
the Building Security Branch is responsible for the interface 
between the FPO's and the Director of Security. .2 of a man 

ear of a staff employee. (Dollar cost of the aia rein- 
ursenent to GSA based on hours worked in FY 1973 - 3,670,000.) 


12. The OS Special Security Center, in accordance with its 
charter, continued throughout FY 1973 providing various policy 
and support services to both the CIA and the overall U.S. 
intelligence community related to the security of compartmented 
intelligence materials. Of special significance was the 
Center's increased emphasis on working with Federal civil 
departments and agencies due to the expanding use ef compart- 
mented intelligence materials by such departments end agencies. 
This matter is expected to require continuing close attention 
throughout FY 1974 te ensure protection of the sensitive intel- 
ligence sources and aethods involy 
services included: 1) security to 25X14 
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13. sb, ight accomplishments and activities of the 
Operational Suppert Division are set forth herein: 


b. Port of Entry and Airline Inspection Procedures 


The Division received seventy requests for assistance 
through U.S. entry procedures and domestic airline procedures. 
The assistance was provided Agency employees escorting 
sensitive equipment and foreign intelligence officials and 
trainees of interest to the Agency. The increase over the 
previous year from thirt enine te seventy is credited to the 
need to assist individuals on domestic and foreign departure 
and arrival flights, because of the use of anti-hijecking 
magnetometer devices by the U.5. air cerricrs. 


c. Cover Support 
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d. Escort Support 


During the Fiscal Year, escort support was requested 
and provided on a routine or special basis on ninety- seven 
different occasions. The support was concerned with the 
movement of classified material, funds and negotiable instru- 
wents for a variety of Agency compon ncluding the Office 
of Security Special Security Center materials), Office 
of Medical Services, Office of Finance, Central Cover Staff, 
Central Reference Service, and the Domestic Contact Service. 


e. VIP Tour and Suppert 


On seven occesions during the Fiscal Year 1973, 
ded components of the Agency in the form of 


f, Surveillance 


g. Support to the DCI and the DDCI 


During the year, the Division received thirty-two 
assignments for support to the DCI and the DDCY. The assign- 
ments consisted of a variety of activities in support of 
oraeticn and foreign travel, social functions, and official 

unctions. 
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14, The Administration and Training Staff provided fiscal, 
personnel, logistical, and training suppert te the Office of 
Security during FY 1973. Man years 22.8; total costs 
$429,698. 
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